CVE-2026-34020Disclosure(apache / openmeetings)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url

Weakness type (CWE)

CWE-598

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openmeetings

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-04-09); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

apache

Products

openmeetings

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-09	2	Disclosure2
2026-04-10	1	Disclosure1

Full discourse3 posts

Open Source Security mailing list@oss_security184d
Disclosure
Apache OpenMeetings CVE-2026-33005: Insufficient checks in FileWebService https://www.openwall.com/lists/oss-security/2026/04/09/10 CVE-2026-33266: Hardcoded Remember-Me Cookie Encryption Key and Salt https://www.openwall.com/lists/oss-security/2026/04/09/11 CVE-2026-34020: Login Credentials Passed via GET Query Parameters https://www.openwall.com/lists/oss-security/2026/04/09/12
Post summary
The post lists three newly disclosed CVEs in Apache OpenMeetings with brief technical descriptions and links to security mailing lists, but does not mention PoC code, exploits, active attacks, patches, or debunking.
00040306
4.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds184d
Disclosure
CVE-2026-34020 Sensitive Query String Exposure in Apache OpenMeetings REST Login Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34020
Post summary
The text announces CVE‑2026‑34020, noting a query‑string information‑disclosure flaw in Apache OpenMeetings’ REST login endpoint, and provides a link to a vulnerability database entry.
0000036
4.0K followersView on X
CVE@CVEnew184d
Disclosure
CVE-2026-34020 Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password … https://www.cve.org/CVERecord?id=CVE-2026-34020
Post summary
The post announces CVE-2026-34020, describing how the Apache OpenMeetings login endpoint uses HTTP GET, exposing credentials via query strings, but it does not provide a PoC, exploit, or patch information.
00000103
57.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	openmeetings	-	-	-

Explore more

Back to dashboard apache CVEs openmeetings vulnerabilities